6 ms·

Interesting approach. Especially if you were to feed the training set with most-used password lists from leaked databases or similar. Do you have any performa

• lyle_nel 11y ago
  Yes the training set should be representative of the candidates you want to crack, also the larger the training set is, the better it seems to perform. It is also important to note that, as passwords are being cracked they become part of the training set. So the program can start of completely blind then it will figure out common structures as the simulation progresses. I have not put them head to head, but the program seems to find passwords that are far outside the tractable search-space for a bruteforce attack. Passwords like the following are found withing a few hours: 34 a111111111111111111111111111111111 20 12345678900987654321 19 9876543211234567089 19 password12345678910 18 sexytinkerbell2013 18 prettyprincess4812 18 mickeymouseforever 18 littlepinkprincess 18 iloveyoumomforever
  • Phemist 11y ago
    So XKCD style correcthorsebatterystaple-esque passwords would fall in no time?
    • lyle_nel 11y ago
      Almost yea. In a few hours it manages to find these horse related passwords. 15 strawberryhorse 15 ilovehorses1995 15 ilovehorses1994 15 ilovehorses1234 15 horselover4ever
      • aidos 11y ago
        Cool system. For clarity though, those aren't xkcd style passwords. They're words that form a normal pattern. Xkcd requires that the words are randomly generated.
        • cheshire_cat 11y ago
          Sorry for going slightly OT but I think more people should know this: xkcd style passwords are actually called diceware passwords [1], the wikipedia article [2] links to arstechnica that reported in 2014 [3] that the original author upped his recommended diceware password length to at least 6 (random) words. You can obviously always use a bigger dictionary too (as long as you choose truly random). [1] http://world.std.com/~reinhold/diceware.html http://world.std.com/~reinhold/diceware.html funny enough, chromium doesn't like the ssl versions the site uses "ERR_SSL_FALLBACK_BEYOND_MINIMUM_VERSION" [2] https://en.wikipedia.org/wiki/Diceware https://en.wikipedia.org/wiki/Diceware [3] http://arstechnica.com/information-technology/2014/03/diceware-passwords-now-need-six-random-words-to-thwart-hackers/ http://arstechnica.com/information-technology/2014/03/dicewa...
          • justifier 11y ago
            this is easier to understand with a bit of math.. let's say you have a pad lock with a 4 number combination, each of those numbers being a ring of 6 numbers themselves(o) we have four 'slots' with six possible numbers for each slot that means there are a total of 1296 combinations, (possible values)^(slots), 6^4=1296 a contemporary computer can do 1300 calculations perceptually instantaneously now we look at randall and diceware's suggestion of using a series of words to bulk out your password, since a word in english is built of a possible combination of 26 character alphabet the possible values becomes 26 for a four letter word, all possible combinations of those 26 characters becomes 26^4=456,976 possible combinations, again, all values can be computed in nanoseconds what i think randall and diceware is hoping to achieve is a higher permutation value with little tax on the user's memory conceptually [c,o,r,r,e,c,t,h,o,r,s,e,b,a,t,t,e,r,y,s,t,a,p,l,e] is 25 characters long with each 'slot' having 26 possible combinations.. 26^25~23x10^34, that is a huge number of possible permutations which makes brute forcing finally impractical but here is where the whole thing starts to break down a bit.. because the suggestion is to use real words to aide in remembering which negates character length in lieu of number of words that also means that figure above is significantly less because the first in that list of 456,976 permutations is ['a','a','a','a'] which would be invalid in regard to existing words, so in reality that 450,000 figure is significantly less 'correcthorsebatterystaple' can be broken into 25 characters 'slots' or 4 word 'slots': [correct,horse,battery,staple] what was 26^25, is now (possible words)^4 we can keep going, look at randall's most recent book(i), using the 1000 most used words possible words becomes 1000 and 4 slots we are looking at 1000^4=1,000,000,000,000 possible permutations which will take a contemporary laptop a few hours, respectively, to churn out all this broken into a chart: 81 = 3**4 : [(3),(3),(3),(3)] 253 = 3**5 : [(3),(3),(3),(3),(3)] 256 = 4**4 : [(4),(4),(4),(4)] 456976 = 26**4 : [(26),(26),(26),(26)] 1000000000000 = 1000**4 [(1000),(1000),(1000),(1000)] ~230000000000000000000000000000000000+ = 26**25 : [(26),(26),(26),(26),(26),(26),(26),(26),(26),(26),(26),(26),(26),(26),(26),(26),(26),(26),(26),(26),(26),(26),(26),(26),(26)] ~640000000000000000000000000000000000000000000+ = (26*2+10)**25 : [(62),(62),(62),(62),(62),(62),(62),(62),(62),(62),(62),(62),(62),(62),(62),(62),(62),(62),(62),(62),(62),(62),(62),(62),(62)] what this is showing you, is that anything that makes things easier for you also will make things easier for a cracker for best security increase the number of characters when possible avoiding words.. using a combination of lowercase(26 characters) and upper case(26 characters) and numbers(0-9, 10) for 26+26+10=62 possible values.. and put those characters in as many slots as you can muster (o) http://www.padlocks4less.com/media/catalog/product/cache/1/image/9df78eab33525d08d6e5fb8d27136e95/c/o/combination_padlocks_2.jpg http://www.padlocks4less.com/media/catalog/product/cache/1/i... (i) https://xkcd.com/thing-explainer/ https://xkcd.com/thing-explainer/
    • minitech 11y ago
      No, the point of that style of password is that you choose the words randomly. Random words are just easier to remember than random characters.